CVE-2026-63867 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability, as it can potentially be exploited to cause issues with MPTCP connections. Affected operators should review the official advisory for specific guidance on patching and mitigation. Vulnerability management teams should prioritize patching based on the potential impact on MPTCP connections. Security teams should monitor for potential issues with MPTCP connections and review compensating controls for exposed systems.

Technical summary

The Linux kernel's MPTCP output path has a TOCTOU (Time-of-Check-to-Time-of-Use) race vulnerability. The MPTCP-level ack_seq is accessed locklessly multiple times, which can lead to inconsistencies in the data_ack values used in the DSS option and the announced rcv wnd computation for the same packet. This refactoring aims to avoid such inconsistencies that could confuse the peer. The MPTCP level rcv wnd is updated only when the egress packet actually contains a DSS ack. This vulnerability can potentially be exploited to cause issues with MPTCP connections.

Defensive priority

Medium High Critical Red High Green Amber Red Amber High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Yellow Green High Red Critical High Green High Red Critical High Green High Red

Recommended defensive actions

• Apply the official patch to update the MPTCP level rcv wnd only when the egress packet actually contains a DSS ack.
• Ensure that the Linux kernel is updated with the latest security patches.
• Monitor MPTCP connections for potential issues.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-19T15:16:53.617Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the specific details of this vulnerability, and defenders should verify the affected scope and severity with the official advisory. The MPTCP output path access locklessly the MPTCP-level ack_seq in multiple times, using possibly different values for the data_ack in the DSS option and to compute the announced rcv wnd for the same packet. This can lead to inconsistencies that may confuse the peer.

Official resources